Infra 360 · Infrastructure Operations & Security
Every device, every vendor. Agents triage. People approve.
Infra 360 inventories your network, security and cloud estate across vendors. It shows which devices are exploitable as they are configured today, tracks what is reaching end of life, and puts NOC and SOC AI agents on triage. Every action they propose waits for a person.
- Read-only connectors
- Runs in your region
- Agents propose, people approve
| Exposure · device | Signal |
|---|---|
| CVE-2024-21762 · fw-01 | KEV |
| CVE-2023-20198 · rtr-01 | KEV |
| CVE-2023-46747 · lb-01 | KEV |
| CVE-2023-22747 · wlc-01 | 9.8 |
Connects read-only to, and checks against
- Platforms
- Cisco Catalyst Center
- F5 BIG-IP
- Fortinet FortiManager
- Cisco Secure Firewall FMC
- HPE Aruba EdgeConnect
- AWS
- Microsoft Azure
- Google Cloud
- Advisory sources
- CISA KEV
- NVD
- Cisco PSIRT
- FortiGuard PSIRT
- F5 Security Advisories
- Cisco EoX
- MITRE ATT&CK
- Model Context Protocol
The problem
Your infrastructure spans five vendors. Your view of it shouldn't.
Three people feel it first. Pick yours.
The challenge
A version scanner says everything is vulnerable. So nothing gets patched first.
Most network CVEs only bite when a specific feature is switched on: the web UI, SSL-VPN, Smart Install, a management port exposed on the data plane. A list sorted by version sends your team to the wrong box first, while the perimeter device that is actually exploitable waits in the queue.
How Infra 360 helps
- Feature-aware matching: exploitable only when the version is affected and the vulnerable feature is enabled. Otherwise it is latent, and labelled that way.
- CISA Known Exploited Vulnerabilities first, weighted by how critical the asset is and whether it faces the internet.
- Quick wins: "disable one feature on these devices and remove these exposures", with the vendor workaround attached.
- A SOC agent that ties brute-force and exploit attempts to the device that is actually exposed.
The challenge
An alarm storm at 2 a.m. and a refresh plan in a spreadsheet.
One failed distribution switch raises a dozen alarms across the access layer, each one a ticket. Meanwhile end-of-sale, end-of-maintenance and last-date-of-support dates live in vendor bulletins nobody tracks against the inventory.
How Infra 360 helps
- A NOC agent that collapses correlated alarms into one root cause and proposes the next step.
- One inventory across Cisco, F5, Fortinet, HPE Aruba and the three major clouds.
- EoX timeline and technical-debt score per asset, with the reasons spelled out.
- Scheduled reports (EoX, inventory, security risk, PSIRT analysis) in CSV or PDF.
The challenge
AI is now part of the infrastructure bill, and nobody can say what it returns.
GPU clusters bought for a pilot sit mostly idle. Scripts send device configs to whichever model has an API key. End-of-life kit carries extended-support premiums nobody has added up.
How Infra 360 helps
- AI infra economics: token cost per agent and per model, GPU utilisation and idle cost.
- Two ROI numbers: value against token cost, and value against token cost plus the AI infrastructure bill. We quote the second.
- Shadow AI found: out-of-region or unapproved models used by infra tooling, flagged as a policy violation.
- Assumptions labelled: hours saved per triage are set by you and shown as assumptions, never as measurements.
The platform
Two planes. One inventory.
Operations tools see what is down. Security tools see what is vulnerable. Infra 360 does both from the same inventory, so the device the NOC agent is watching is the same device the vulnerability queue ranks.
- Campus & WANCatalyst Center · EdgeConnect
- Security & deliveryFortiManager · FMC · BIG-IP
- CloudAWS · Azure · Google Cloud
- Exploitable nowpatch or apply workaround
- Latentfeature off · schedule
- Healthysupported · no action
Operations plane
See it, triage it, report it.
Inventory, health and the NOC and SOC agents that turn events into a short list of decisions.
Risk & economics plane
Rank it, retire it, price it.
Exposure, lifecycle, governance and the cost of the AI infrastructure the agents run on.
Feature-aware exposure
Same version. Different risk. It depends on what's switched on.
Infra 360 matches each device's software version against vendor advisories, then checks whether the feature the CVE needs is enabled in its configuration. Toggle the feature and watch the verdict change.
- Fixed release beats guesswork. At or above the fixed release, the device is not affected, and we say so.
- Confidence shown. Where a vendor's fix varies by sub-release, the match is flagged to confirm with the vendor's own checker.
NOC & SOC agents
Agents do the triage. People make the change.
The NOC agent correlates operational alarms into root causes. The SOC agent ties security events to exposed devices and maps them to MITRE ATT&CK. Both run on an in-region model, and both stop at a proposal.
- Two-person rule. Whoever ran the agent cannot approve its actions.
- Nothing is pushed. Approval records a decision for the change owner; Infra 360 never writes configuration to a device.
- Every run metered. Tokens and cost per run, with estimated figures labelled as estimates.
42 failed VPN logins → edge-fw-dc-01 · CVE-2023-20269 exploitable · T1110 Brute Force
- CorrelateEvents grouped by device, matched to open exposuresDONE
- AssessKnown-exploited CVE on an internet-facing firewall: criticalDONE
- ProposeBlock top sources for 24h · enforce MFA on remote-access VPNDONE
- ApproveWaiting on a second, named approverHOLD
- RecordDecision logged; the change owner executes—
How it works
From first connector to a ranked, triaged estate in four steps.
Connect
Point Infra 360 at your controllers and clouds with read-only credentials held in your own vault.
What we read
- Devices, models, software versions
- Sites, roles and enabled features
- Cloud resources across accounts
Match
Every device is matched against vendor PSIRT advisories and lifecycle dates, feature by feature.
What we check
- Vendor PSIRT advisories and NVD
- CISA Known Exploited Vulnerabilities
- End of sale, maintenance and support
Triage
NOC and SOC agents turn events into findings and proposed actions for a person to approve.
What we propose
- Root cause for alarm storms
- Workarounds for exploitable devices
- Blocks and MFA for attack patterns
Report
Lifecycle, risk and AI-infra cost, on demand or on a schedule, for the ops review and the board.
What we report
- EoX and inventory
- Security risk and PSIRT analysis
- Token cost and AI/token ROI
Why Blackbead
Built for regulated infrastructure. Honest about every number.
Read-only by design
Connectors list and describe. They never change configuration. An unconfigured connector returns nothing and says why.
Feature-aware, not version-only
Exploitable and latent are different states, and the queue is ranked by the one an attacker can use today.
People approve, agents propose
Two-person approval on every agent action. The decision is recorded; the change stays with its owner.
Residency first
Deployed in your region, in your account. Device data only reaches in-region or on-box models.
Vendor-agnostic
Cisco, F5, Fortinet, HPE Aruba, AWS, Azure and Google Cloud in one inventory, one risk queue and one report.
Every number has a source
Lifecycle dates, advisories and token counts carry their provenance. Demo data and assumptions are labelled.
One view of the infrastructure under your APIs and your AI.
Infra 360 runs inside your own cloud account, in your region, for infrastructure, security and finance teams in regulated industries. It sits alongside API 360 and AI 360, or on its own, and every decision it records is kept for audit.
Get a free infrastructure assessment.
Connect one controller or cloud account read-only. In a working session we show you what's running, what's exploitable and what's reaching end of life.
- Inventory with lifecycle status per asset
- Top exploitable exposures, known-exploited first
- Quick wins: the features to switch off this week
Book your assessment
30 minutes with the founder. Bring one controller or cloud account. We bring the read-only connector.
Book your assessment Explore AI 360Or write to info@blackbead.ai